Do I need to validate commercial software like Microsoft Word or Excel?
No. Nor will you be able to without significant input from Microsoft – input you will not get unless you can write a multi-million dollar check (and not have it bounce). Here’s what George Smith, the chair of FDA’s internal Part 11 working group has to say on this: Validation is to intended use. Thus, the exact same two computers or two exact same software installations at two different companies produce two different sets of records.
No. Nor will you be able to without significant input from Microsoft – input you will not get unless you can write a multi-million dollar check (and not have it bounce). Here’s what George Smith, the chair of FDA’s internal Part 11 working group has to say on this:
Validation is to intended use. Thus, the exact same two computers or two exact same software installations at two different companies produce two different sets of records.
In other words, you validate the process in which you use Word or Excel (or any other commercial software) for its intent (production and maintenance of a record, computation of a formula, etc.). The degree of risk associated with the process/data will drive the level of validation needed and the degree of Part 11 controls necessary on the automation involved and the records generated.
Thus, if I use a spreadsheet macro in order to calculate a critical quality attribute of temperature, then I’d validate the macro itself and ensure a significant number of controls on the macro (so it wasn’t accidentally messed up if an Excel patch is auto applied) and on the data results. I would not go about trying to validate Excel as a piece of software. Incidentally, a good resource on spreadsheet macro validation in laboratory environs is Ludwig Huber’s LabCompliance.com site.
Likewise, if I use Word to author SOPs, I would not validate Word per se but rather validate my SOP process that happens to rely upon Word to automate some aspects (spelling, etc.). In this light, my validation efforts will likely be very light (afterall, how many of us have the money and time to spend conducting process validation on our SOP of SOPs process?).
The key is to view any commercial software as a tool. When it comes to off-the-shelf software, think of Part 11 validation as automated process validation rather than computer validation. The Part 11 controls then largely center around ensuring data integrity (i.e., data integrity tips or steps).
